<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<ui:composition xmlns="http://www.w3.org/1999/xhtml"
	    		xmlns:ui="http://java.sun.com/jsf/facelets"
				xmlns:c="http://java.sun.com/jsp/jstl/core"
				template="layouts/standard.xhtml">
<ui:define name="notes">
	<p>
		Form-based authentication with Spring Security.
		Spring Security is first enabled in web.xml via DelegatingFilterProxy.
		It's configuration is located in <strong>security-config.xml</strong>.
		Flow definitions can further be protected using the secured attribute (see <strong>booking-flow.xml</strong>). 
	</p>
</ui:define>
<ui:define name="content">
<div class="span-5">
	<p>Valid username/passwords are:</p>
	<ul>
		<li>keith/melbourne</li>
	    <li>erwin/leuven</li>
	    <li>jeremy/atlanta</li>
	    <li>scott/rochester</li>
	</ul>
</div>
<div class="span-10 append-2 last">
	<c:if test="${not empty param.login_error}">
		<div class="error">
			Your login attempt was not successful, try again.
		</div>
	</c:if>
	<form name="f" action="${request.contextPath}/spring/loginProcess" method="post">
		<fieldset>
			<legend>Login Information</legend>
				<p>
					User:
					<br />
					<input type="text" name="username" value="#{username}"/>
				</p>
				<p>
					Password:
					<br />
					<input type="password" name="password" />
				</p>
				<p>
					<input type="checkbox" name="_spring_security_remember_me"/> 
					Don't ask for my password for two weeks:
				</p>
				<div>
					<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
				</div>
				<p>
					<input name="submit" type="submit" value="Login" />
				</p>
		</fieldset>
	</form>
</div>
</ui:define>
</ui:composition>